NSA ANT Mobilfunk, 30C3, Jacob Appelbaum, 30 December 2013 


Zum Uberwachen und Verfolgen von Handys hat die NSA-Abteilung ANT gleich eine ganze Palette von 
Geräten im Angebot. Das reicht von speziell ausgeriisteten Spezialhandys, mit denen sich ein anderes Han 
räumlich verfolgen lässt, bis hin zu voll ausgestatteten GSM-Basisstationen, die sich als offizielle Handy- 
Funkantennen des Netzbetreibers ausgeben können und es dann erlauben, Gespräche oder SMS von 
Mobiltelefonen in ihrer Reichweite zu überwachen und mitzuschneiden. Man denke nur an die mutmaßliche 
Überwachung des Handys von Bundeskanzlerin Angela Merkel. Mehrere der spezialisierten Mobilfunk- 
Basistationen sind auch in der Lage, den genauen Aufenthaltsort eines Handynutzers in ihrer Reichweite zu 
ermitteln. Ein Gerät namens CANDYGRAM nennen die ANT-Techniker "Telefon-Stolperdraht": Es schickt e 
SMS in die Kommandozentrale, sobald die Benutzer bestimmter Mobiltelefone in Reichweite sind. 


CROSSBEAM ist ein Implantat, das dieselbe Form hat wie ein GSM-Modul, wie es etwa in Notebooks 
verwendet wird. Es ermöglicht externen Zugriff auf die übertragenen Daten und das System. 


CANDYGRAM ist ein GSM-Basisstations-Simulator (für die Frequenzbereiche 900/1800/1900 Mhz), der die 
Standortdaten der Handys von Zielpersonen über das Senden von nicht angezeigten SMS überprüft 


CYCLONE HX9 ist ein GSM-Funkzellensimulator für Angriffe auf GSM-900-Mobilfunkgeräte. Solche 
Basisstationen werden benutzt, um Handys abzuhéren und Daten von ihnen abzufangen. Es besteht der 
Verdacht, dass die NSA etwa das Mobiltelefon von Bundeskanzlerin Angela Merkel abgehört hat. 


EBSR ist ein aktiver GSM-Zellensimulator, der Angriffe auf GSM-Mobiltelefone in den Frequenzbereichen 
‚900/1800/1900 Mhz ermöglicht. 


ENTOURAGE ist ein Funkempfänger zum Orten von GSM- und 3G-Mobiltelefonen, der die GPS-Koordinat« 
der Mobiltelefone von Zielen ermittelt. 


Bei GENESIS handelt sich um ein modifiziertes Mobiltelefon für GSM und 3G, mit dem sich Netzparameter 
und Frequenznutzungen feststellen sowie Mobiltelefone orten lassen. 


NEBULA ist ein GSM-Zellensimulator für 2G-Netze (900 Mhz) und 3G-Netze (2100 Mhz). 


TYPHON HX: Ein GSM-Zellensimulator für alle weltweit gängigen GSM-Frequenzen (850/900/1800/1900 
Mhz). Damit lassen sich Mobiltelefone abhören. 


WATERWITCH ist ein Gerät, mit dem sich der exakte Standort der Mobiltelefone von Zielpersonen in 
unmittelbarer Nähe feststellen lässt. 
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CROSSBEAM 


ANT Product Data 


(TSIISI/REL) CROSSBEAM is a GSM module that mates a modified commercial T 08/05/08 
cellular product with a WAGONBED controller board. 


— 


‘WAGON nern 


(TSISWIREL) CROSSBEAM is a reusable CHIMNEYPOOL-compliant GSM 
communicatons module capable of collecting and compressing voice data. 
CROSSBEAM can receive GSM voice, record voice data, and transmit the received ow 
information via connected modules or 4 different GSM data modes (GPRS, Circuit 

Switched Data, Data Over Voice, and DTMF) back to a secure facility, The 
CROSSBEAM module consists of a standard ANT architecture embedded computer, | @ 0 ¢ 
a specialized phone component, a customized software controller suite and an 


optional DSP (ROCKYKNOB) if using Data Over Voice to transmit data. |} 0 % 
CROSSBEAM Voice Handling d % ¢ 
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: Limited Supply Available Unit Cost: $4k 
Delivery: 90 days for most configurations 
POC: TT $3223, BIO = ic. Deves rom: sae 
ALT POC: EE, $3223, I RES cc.‘ Dectassity On: 20320108 
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CANDYGRAM 


GSM Telephone Tripwire 


(SIISUIREL) Mimics GSM cell tower of a target network. Capable of operations at 
900, 1800, or 1900 MHz. Whenever a target handset enters the CANDYGRAM 

base station's area of influence, the system sends out an SMS through the external | 06120108 
network to registered watch phones. 


Command center 
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(SISWIREL) CANDYGRAM Operational Concept I 0 I 

(S//SVIREL) Typical use scenarios are asset validation, target tracking and 00000 
identification as well as identitying hostile surveillance units with GSM handsets. 
Functionality is predicated on apriori target information 0000 

(SISUIREL) System HW (SIISWIREL) SW Features | §9QQ 
* GPS processing unit + Configurable 200 phone number |} (1) 
+ Tri-band BTS radio datyetdects on 

+ Network auto-configuration 
+ Windows XP laptop and cell phone* + Area Survey Capability 00 
Pr m ay * Remote Operation Capability 
EP ENLAI" deep, + Configurable Network emulation 

+ External power (9-30 VDC) + Configurable RF power level 


* Mutli-Units under single C&C 


*Remote control software can be used 
* Remote restart 


with any connected to the laptop (used 


for communicating with the z Renee gene (not field 
CANDYGRAM unit through text recoverable) 
messages (SM8); Status: Available 8 mos ARO 


Unit Cost: approx $40K 
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Derived From: NSACSSM 1-52 
‘Dated: 20070108 
Declaseity On: 20320108 
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(SIISIIFVEY) EGSM (900MGz) macro-ciass Network-In-a-Box (NIB) system. Uses 
the existing Typhon GUI and supports the full Typhon feature base and applications. 


CYCLONE Hx9 


Base Station Router 


(SI/ISUIREL) Operational Restrictions > (SIISWIREL) Enclosure: 
exist for equipment deployment. ASN 
* Approximately 8 Ibs 

* Actively cooled for extreme 
environments 


> (SIISWIREL) Cyclone Hx9 System Kit 


* Cyclone Hx9 System 
* ACIDC power converter 
* Antenna to support MS, GPS, WIFI, & 


> (SIISUIREL) Features: 
* EGSM 900MHz 


»Macro-class (+43dBm) 
+32+Km Range 

* Optional Battery Kits 

* Highly Mobile and Deployable 
» Integrated GPS, MS, & 802.11 
* Voice & High-speed Data 

* GSM Security & Encryption 


> (SIISUIREL) Advanced Features: 


* GPS - Supporting Typhon 
applications 


* GSM Handset Module - Supports 
auto-configuration and remote 
‘command and control features. 

* 802.11 — Supports high speed 


wireless LAN remote command and 
control 


Status: Just out of development, first production runs ongoing, 


Poc: EE, 532242, MI, BF >. co 


RF 
* LAN, RF, & USB cables 
* Pelican Case 


* (Field Kit only) Control Laptop and 
Accessories 


> (SISWIREL) Separately Priced Options: 


* 800 WH Lilon Battery Kit 


> (SIISWIREL) Base Station Router Platform: 


* Overlay GSM cellular communications 
supporting up to 32 Cyclone Mx9 
systems providing full mobility and 
utiizing a VoIP back-haul 

® GPRS data service and associated 
application 


Unit Cost: $70K for two months 


SECRET//COMINT/REL TO USA, FVEY 


Derived From: NSACSSM 1-52 


‘Dated: 20070108 


Declassity On: 20220208 
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(SIISUIREL) Multi-purpose, Pico class, tri-band active GSM base station with 


internal 802.1/GPS/handset capability. 


EBSR 


Low Power GSM Active Interrogator 


01/27/09 
| 


(SIISUIREL) Operational Restrictions 
exist for equipment deployment. 


> (SI/SUIREL) Features: 
* LxT Model: 900/1800/1900MHz 
* LxU Model: 850/1800/1900MHz 
* Pico-class (1Watt) Base station 
* Optional Battery Kits 
* Highly Mobile and Deployable 
* Integrated GPS, MS, & 802.11 
* Voice & High-speed Data 
* SMS Capability 


> (SIISIIREL) Enclosure: 
* 1.9'Hx B.6°W x 6.3"D 
* Approximately 3 Ibs 


* Actively cooled for extreme 
environments 


Status: 


> (SIISUIREL) EBSR System Kit: 
* EBSR System 
= ACIDC power converter 


* Antennas to support MS, 
GPS, WIFI, & RF 


* LAN, RF, & USB cables 
* Pelican Case 


* (Field Kit only) Control Laptop 
and Accessories 


> (SISUIREL) Separately Priced Options: 


* 90 WH Lilon Battery Kit 


> (SIISUIREL) Base Station Router 
Platform: 


* Multiple BSR units can be 
interconnected to form a macro 
network using 802.3 and 802.11 
back-haul. 


* Supports Landshark/Candygram 
capabilities. 


Unit Cost: $40K 


Poc: MEN. 532242. HE 3 sic cov 


Derived From: NSACSSM 1-52 


‘Dated: 20070108 


Doclasaity On: 20920108. 
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(SIISUIREL) Direction Finding application operating on the HOLLOWPOINT 
platform. The system is capable of providing line of bearing for GSMIUMTSI 
CDMA2000/FRS signals. A band-specific antenna and laptop controller is needed to 
compliment the HOLLOWPOINT system and completes the ground based system. 


ENTOURAGE 


(S/SI/REL) Direction Finding on 
HollowPoint Platform 


01127109 
N 


(SHSWIREL) HOLLOWPOINT SDR Platform and Antenna 


(SIISI) The ENTOURAGE application leverages the 4 Software Defined Radio 
(SDR) units in the HOLLOWPOINT platform. This capability provides an "Artemis- 
like" capability for waveforms of interest (26,3G,others). The ENTOURAGE 
application works in conjunction with the NEBULA active interrogator as part of the 
Find/Fix/Finish capabilities of the GALAXY program. 


> (SIISIIREL) Features: > (SISWREL) Enclosure: 
* Software Defined Radio System * 1.8"H X 8.0"W x 8.0"D 
* Operating range 10MHz — AGHz * Approximately 3 Ibs 
* 4 Receive paths, all synchronized «15 Watts 
* 1 Transmit path + Passively cooled 
© DF capability on > (SIISWREL) Future Developments: 
GSM/UMTS/CDMA2000/ FRS = WiMAX 
signals 
* WiFi 


* Gigabit Ethernet 
* Integrated GPS 


"LTE 


* Highly Mobile and Deployable 


Status: The system is in the final testing stage and Unit Cost: $70K 
will be in production Spring 09. 
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GENESIS 


Covert SIGINT Transceiver 


(S/SWIREL) Commercial GSM handset that has been modified to include a + 
Software Defined Radio (SDR) and additional system memory. The internal SDR 
allows a witting user to covertly perform network surveys, record RF spectrum, or 01/27109 
perform handset location in hostile environments. \ 

t 


(SISWIREL) GENESIS Handset v (1) 


(SISWIREL) The GENESIS systems are designed to support covert operations in 

hostile environments. A witting user would be able to survey the local environment ¢ (1) v 
with the spectrum analyzer tool, select spectrum of interest to record, and download 

the spectrum information via the integrated Ethernet to a laptop controller. The |} 0 % 
GENESIS system could also be used, in conjunction with an active interrogator, as the 
finishing tool when performing Find/Fix/Finish operations in unconventional d % v 
environments. 

> (SIISIIIREL) Features: > (SIISUIREL) Future Enhancements: [|] (1) % 


* Concealed SDR with Handset + 3G Handset Host Platform 


Merulmkangen * Additional Host Platforms on 


* Spectrum Analyzer Capal Sirenen Mara CADRE N ’ 
*'Find/FixFinish Capability * Additional Find/Fix/Finish 
+ Integrated Ethernet Capabilities 


* External Antenna Port * Active Interrogation Capabil 


* Internal 16 GB of storage 


* Multiple Integrated Antennas 


Status: Current GENESIS platform available. Unit Cost: $15K 
Future platforms available when developments are 

completed. 
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NEBULA 


Base Station Router 


(SIISWIFVEY) Multi-Protocol macro-class Network-In-a-Box (NIB) system. 

Leverages the existing Typhon GUI and supports GSM, UMTS, CDMA2000 01/27109 

applications. LTE capability currently under development. \ 
(SISIIREL) Operational > (SIISWIREL) Enclosure: ' 
Restrictions exist for equipment © 8.5'H x 13.0"W x 16.5"D 
deployment. * Approximately 45 Ibs 


* Actively cooled for extreme 
environments 


> (SIISWIREL) NEBULA System Kit: 
* NEBULA System 


* 3 Interchangeable RF bands m 
> (SISUIREL) Features: * AGIDG power converter 
* Antenna 10 support MS, GPS, 
* Dual Carrier System e (] II} ¢ 
x WIFI, & RF 
* EGSM 900MHz 
* LAN, RF, & USB cables (LETI) 
* UMTS 2100MHz 
* Pelican Case 
+ CDMA2000 1900MHz 
* (Field Kit only) Control Laptop |) (1) (] 
* Macro-class Base station and Accessories 
rel Bien A >earsimet) SopantelPreed onions: | NN 
* Highly Mobile and Deployable * 1500 WH Lilon Battery Kit N Y 
* Integrated GPS, MS, & 802.11 > (SIISIIREL) Base Station Router Platform: 
* Voice & High-speed Data * Multiple BSR units can be rT) 
interconnected to form a macro network 


> (S/ISIIREL) Advanced Features: using 802.3 and 802.11 back-haul 


* Future GPRS and HSDPA data 
service and associated appiications 


* GPS - Supporting NEBULA 
applications 


* Designed to be self-configuring 
with security and encryption features 


* 802.11 - Supports high speed 
wireless LAN remote command and 
control 


Status: Unit Cost: $250K 
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TYPHON HX 


GSM Base Station Router 


(SIISUIFVEY) Base Station Router - Network-In-a-Box (NIB) supporting GSM Tr 
bands 850/900/1800/1900 and associated full GSM signaling and call control. 06120108 


(SIISWIFVEY) Tactical SIGINT elements 
use this equipment to find, fix and finish 
targeted handset users, 


(SIISI) Target GSM handset registers with 
BSR unit. 


(SIISI) Operators are able to geolocate 
registered handsets, capturing the user. 


(SISURREL) The macro-lass Typhon isa Nework-n-a Toon red Ons 
Box (NIB), which includes al the necessary architecture to M 
‚support Mobile Station call processing and SMS EEE BETT | 
messaging in a standalone chassis with a pre- 

provisioning capability. 

Bon EOST 


e | _ eimamen lese 
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(SISUIREL) The Typhon system kit includes the amplified 
Typhon system, OAM&P Laptop, cables, antennas and 


ACIDC power supply. Bien Des] _ einen acimus 
Ermes peio 
(U/FOUO) An 800 WH Lilon Battery kit is offered EEEE [or 
separately. 
(U) A bracket and mounting kit are available upon (U) Status: Available 4 mos ARO 
request. 


(SIISWREL) Operational Restrictions 
exist for equipment deployment. 


POC: TE 532242, a 
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(S//SI) Hand held finishing too! used for geolocating targeted handsets 
in the field, 


WATERWITCH 


Handheld Finishing Tool 


07/30/08 
| 


(SIISI) Features: 
e Split display/controller for 
flexible deployment 
capability 
« External antenna for DFing 


target; internal antenna for g 
communication with active 


interrogator 

«Multiple technology 

capability based on SDR (SIISI) WATERWITCH Handset DF Set 
Platform; currently UMTS, with GSM and CDMA2000 under 

development 

Approximate size 3” x 7.5" x 1.25" (radio), 2.5" x 5" x 0.75" 
(display); radio shrink in planning stages 

e Display uses E-Ink technology for low light emissions 


(S/ISI) Tactical Operators use WATERWITCH to locate 
handsets (last mile) where handset is connected to Typhon or 
similar equipment interrogator. WATERWITCH emits tone and 
gives signal strength of target handset. Directional antenna on 
unit allows operator to locate specific handset. 


Status: Under Development. Available FY-2008 Unit Cost: 
LRIP Production due August 2008 


POC: RN, 532242, EN BIO ns ic.qov 
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